CVE-2026-68130

What it actually does

This flaw affects the Linux kernel ksmbd SMB server’s NTLM authentication flow. During NTLM authentication, ksmbd could process a client-supplied username and PreviousSessionId before validating the NTLMv2 response. An already authenticated attacker could craft an NTLM authentication message that names another user and references that victim’s active SMB session ID, causing ksmbd to destroy the victim’s session even though the attacker’s authentication attempt is later rejected. The practical result is unauthorized termination of active SMB sessions, producing a denial-of-service condition for users connected to SMB shares hosted by ksmbd.

Why it matters to the business

An attacker with valid SMB access can disrupt other users’ file-sharing sessions, potentially interrupting access to shared files, application data, backups, automation jobs, or operational workflows that depend on Linux-hosted SMB shares. Because this is a denial-of-service issue rather than direct code execution or data theft, the primary risk is availability loss, user disruption, failed file operations, and potential data inconsistency if applications are disconnected mid-operation. The issue is newly published and is not currently listed in CISA KEV, has no known ransomware association, and has no reported mature public exploit, but exposed ksmbd services should still be prioritized where SMB availability is business-critical.

How an attack unfolds

An attacker first needs legitimate access sufficient to interact with the ksmbd SMB service. The attacker establishes or reuses an authenticated SMB connection, observes or obtains a target session identifier, then sends a crafted NTLMSSP authentication request. In that request, the attacker places the victim account name in the NTLM blob username field and sets the PreviousSessionId value to the victim’s active session ID. Vulnerable ksmbd code resolves the supplied username and destroys the referenced previous session before validating whether the NTLMv2 response is authentic. The authentication attempt then fails, but the victim’s session has already been torn down, causing disconnection or interruption of SMB operations. Repeating this process can create ongoing disruption for selected users or shared-service workloads.

How to fix it

Upgrade the Linux kernel to a version that includes the ksmbd fix moving destroy_previous_session() until after successful NTLM authentication validation. Because no exact fixed package versions were provided in the input, use the fixed kernel packages from the relevant Linux distribution or vendor advisory as the authoritative source. If immediate patching is not possible, reduce exposure by disabling ksmbd where it is not required, replacing ksmbd with a patched SMB implementation where appropriate, limiting SMB access to trusted networks, restricting authenticated SMB accounts to least privilege, and monitoring or rate-limiting repeated failed NTLM session setup attempts. If NTLM is not required, prefer stronger authentication configurations supported by the environment.

How to confirm the fix worked

Confirm whether systems are using ksmbd rather than user-space Samba by checking loaded kernel modules, running services, and listening SMB ports. Validate remediation by confirming the installed kernel build includes the vendor fix for this issue, then reboot if required so the patched kernel is active. Verify that SMB service functionality remains intact after patching. Exposure can be checked by identifying Linux systems listening on TCP/445 with ksmbd enabled and NTLM authentication available. A controlled validation test should confirm that a failed NTLM authentication attempt with a supplied PreviousSessionId no longer terminates another user’s active SMB session; perform this only in an isolated test environment.

Typical attack path

1. Identify a Linux host running the in-kernel ksmbd SMB server with NTLM authentication enabled.
2. Authenticate to the SMB service using an account available to the attacker.
3. Identify or infer an active victim SMB session and its session identifier.
4. Send a crafted SMB session setup / NTLMSSP authentication message containing the victim username and victim PreviousSessionId.
5. Trigger ksmbd to destroy the victim session before the malicious NTLM response is rejected.
6. Repeat the process to continually disconnect users or disrupt SMB-dependent workloads.

How to detect it

To determine whether this was already exploited, focus on evidence of repeated SMB session disruption paired with failed NTLM authentication attempts. Useful sources include kernel logs, system journal logs, ksmbd service logs if enabled, auditd records, EDR process and network telemetry, firewall or Zeek/Suricata SMB telemetry, and packet captures for SMB2 SESSION_SETUP traffic. Look for clusters of failed NTLMSSP authentication attempts from the same source host or account, especially when followed immediately by unrelated users being disconnected from SMB shares. Network telemetry is especially useful because the crafted request involves SMB session setup, NTLMSSP authentication, and a nonzero PreviousSessionId value. Also review helpdesk reports or file server monitoring for sudden SMB disconnects, interrupted file writes, failed backup jobs, or repeated reconnects affecting specific users. Because default ksmbd logging may not record the vulnerable internal function call or PreviousSessionId value, absence of direct log strings does not rule out exploitation; correlation between authentication failures and victim session teardown is the strongest practical signal.

• ksmbd
• ksmbd.mountd
• tcp/445
• SMB2 SESSION_SETUP
• NTLMSSP_AUTH
• PreviousSessionId
• NT_STATUS_ACCESS_DENIED
• NT_STATUS_LOGON_FAILURE
• ntlm_authenticate
• destroy_previous_session

What your security team should do

• Prioritize patching Linux systems that expose ksmbd over TCP/445, especially file servers, backup repositories, application file shares, and systems reachable by many authenticated users.
• Inventory SMB services and distinguish Linux kernel ksmbd from Samba or other SMB implementations, since the vulnerability is specific to ksmbd.
• Limit SMB access to trusted network segments and block unnecessary inbound TCP/445 exposure at firewalls and security groups.
• Review SMB authentication logs, kernel logs, and network telemetry for repeated failed NTLM authentication attempts correlated with unexpected session disconnects.
• Temporarily disable ksmbd or migrate critical shares to a non-vulnerable SMB service if patching cannot be completed promptly.
• Ensure monitoring alerts on abnormal SMB session churn, repeated NTLMSSP authentication failures, and user reports of sudden share disconnections.
• After patching, confirm the fixed kernel is actively running, not merely installed.